Google Cloud Workload Manager Evaluator
Evaluate Google Cloud workloads against best-practice rules and review actionable findings.
The skill requires public APIs, prohibits internal interfaces, and distinguishes viewer, evaluationAdmin, and admin roles. It discloses scan scope, result contents, BigQuery, CMEK, service accounts, and pre-delete checks, with force deletion called out. Deductions apply because create, update, and run examples do not consistently require user confirmation, systematic rollback is absent, and control of tokens and resource metadata is largely left to the operator.
The client-library and REST workflows are broadly consistent and cover asynchronous-operation timeouts, polling, request IDs, authentication fallback, and avoidance of retry loops. The score is reduced because there are no committed tests or CI checks; placeholder values, missing permissions, disabled APIs, invalid regions, and nonexistent resources receive limited diagnostic and recovery guidance, with some behavior deferred to current documentation checks.
Trigger scenarios, capability boundaries, and explicit non-fit areas are clear. The skill covers rules, evaluations, executions, results, scanned resources, and BigQuery exports, with organization- and project-level alternatives. Deductions reflect incomplete structured input/output contracts, limited exclusion criteria for semantic triggering, no stated Chinese-language support, and no mitigation for possible mainland-China reachability constraints affecting Google Cloud documentation or APIs.
The references are organized into concepts, client libraries, REST, CLI/MCP status, prerequisites, and IAM/security, with progressive disclosure, install commands, Python/Go examples, limitation notes, Apache-2.0 licensing, and official references. The score is reduced for missing skill-specific versioning, changelog, named maintenance responsibility, and update path; FAQ/troubleshooting coverage is thin, and the IAM reference table contains visibly damaged Markdown formatting.
The skill supplies an end-to-end path from listing rules through evaluation creation, execution, findings review, and export, with practically useful Python, Go, REST, and prerequisite Terraform examples. Static calibration caps the score at 7; deductions apply because every example depends on real projects, permissions, locations, and rule names, with no verified outputs or complete runnable wrapper, so environment adaptation and human review remain necessary.
The material links to official Workload Manager, REST, IAM, Python package, and custom-rule references and distinguishes public client-library and REST boundaries; repository context also supplies Apache-2.0 licensing and official-organization provenance. The score is reduced because there are no committed tests, CI execution records, or independent reproduction reports, and static review cannot confirm that the examples run as written.
- Before creating, updating, running, or deleting an evaluation, display the project, location, resource scope, rules, schedule, BigQuery dataset, and CMEK and obtain user confirmation.
- Do not apply the organization-level examples directly to production; validate first with the smallest project or label scope, including permissions, result volume, and cost.
- Access tokens, scan results, service accounts, labels, and resource configurations may contain sensitive metadata; restrict logs and BigQuery dataset access.
- Check the current client-library and REST documentation before execution; placeholders, permissions, fields, and the rule catalog are not statically verified.
- Google Cloud APIs and documentation may be unreachable or unstable from mainland China; confirm connectivity and prepare offline references.
What does this skill do, and when should you use it?
This Agent Skill provides focused guidance for managing Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results. It covers selecting a project, folder, or organization scope, choosing built-in or custom rules, running evaluations, and reviewing violations. Results can also be exported to BigQuery. It uses the public Python client library or REST API and is not intended for general Compute Engine management, VPC configuration, or standard IAM auditing.
Lists Workload Manager rules; creates or updates evaluations; sets resource scope and evaluation type; runs evaluations; reads evaluation results, violations, and scanned resources; provides BigQuery export guidance; automates Workload Manager through the public Python client library or the workloadmanager.googleapis.com/v1 REST API; and switches to example code and static findings when authentication, API enablement, or mock resources fail.
- A cloud platform administrator wants to evaluate workloads at project, folder, or organization scope against Google Cloud general best practices.
- An SAP team needs to run Workload Manager evaluations for SAP workloads and review violations.
- A SQL Server administrator wants to inspect database workloads with built-in rules.
- An enterprise platform team needs governance checks based on custom organizational rules and Rego.
- An operations team needs to review evaluation findings and export results to BigQuery for analysis.
What are this skill's strengths and limitations?
- Covers the core flow from rules and evaluations through scanned resources, results, and violations.
- Supports Google Cloud general best practices, SAP, SQL Server, and custom organizational rules.
- Clearly restricts integrations to the public client library or REST API.
- Includes references for Python, Go, REST, IAM, and BigQuery export guidance.
- Requires API enablement, ADC authentication, and suitable IAM roles for the service agent and operator.
- There is no public service-specific `gcloud workload-manager` CLI and no documented public Workload Manager MCP server.
- The source provides no standalone test suite, pinned versions, or performance guarantees.
- Uncovered API fields and product behavior require checking current Google Cloud documentation and client-library references.
How do you install this skill?
In an Agent Skills-compatible environment, run npx skills add google/skills and select skills/cloud/workload-manager-basics. The README documents installation of individual skills from the repository, but does not provide a separate Workload Manager package.
How do you use this skill?
Enable the API with gcloud services enable workloadmanager.googleapis.com --quiet, configure ADC with gcloud auth application-default login, and grant the appropriate Workload Manager IAM roles. Then prompt the Agent, for example: “List the Workload Manager rules for project PROJECT_ID in LOCATION, then show how to create, run, and inspect an evaluation.” Use the google-cloud-workloadmanager Python client library or the public REST API; no public gcloud workload-manager command group is documented.